




kok电子竞技权说明:本文档由用户提供并上传,收益归属内容提供方,若内容存在侵权,请进行举报或认领
kok电子竞技:文档简介
国际信息安全技术标准发展
ISO/IECJTC1/SC27/WG4江明灶Meng-ChowKang,CISSP,CISAConvener,SecurityControls&ServicesWorkingGroup(WG4),ISO/IECJTC1SC27(SecurityTechniques)ChiefSecurityAdvisorMicrosoftGreatChinaRegionWG1ISMSStandardsChairTedHumphreysVice-ChairAngelikaPlateWG4SecurityControls&ServicesChairMeng-ChowKangWG2SecurityTechniquesChairProf.KNaemuraWG3SecurityEvaluationChairMatsOhlinWG5PrivacyTechnology,IDmanagementandBiometricsChairKaiRannenbergISO/IECJTC1SC27ChairWalterFumyViceChairMarijikedeSoeteSecretaryKrystynaPassia27000Fundamental&Vocabulary27004ISMSMeasurement27005ISMSRiskManagement27006AccreditationRequirements27001ISMSRequirements27003ISMSImplementationGuidanceInformationSecurityManagementSystems(ISMS)27002CodeofPracticeISMSFamilyRiskmanage;Preventoccurrence;ReduceimpactofoccurrencePreparetorespond;eliminateorreduceimpactSC27WG4RoadmapFrameworkInvestigatetoestablishfactsaboutbreaches;identifywhodoneitandwhatwentwrongUnknownandemergingsecurityissuesKnownsecurityissuesSecuritybreachesandcompromisesNetworkSecurity(27033)TTPServicesSecurityICTReadinessforBusinessContinuity(27031)SC27WG4RoadmapApplicationSecurity(27034)ForensicInvestigationCybersecurity(27032)IncludesISO/IEC24762,VulnerabilityMgmt,IDS,&IncidentResponserelatedstandardsAnti-Spyware,Anti-SPAM,Anti-Phishing,Cybersecurity-eventcoordination&informationsharingISO18028revision;WDfornewPart1,2&3;NewStudyPeriodonHomeNetworkSecurity1stWDavailableforcommentsFutureNPNewStudyPeriodproposed;Includesoutsourcingandoff-shoringsecurityGapsbetweenReadiness&Response
ITSecurity,BCP,andDRPPlanning&ExecutionProtectDetectReact/ResponseITSecurityPlanningActivateBCPActivateDCRPPlanPrepare&TestPlanPrepare&TestBusinessContinuityPlanningDisasterContingency&RecoveryPlanningDisasterEventsITSystemsFailuresICTReadinessforBusinessContinuityWhatisICTReadiness?PrepareorganizationICTtechnology(infrastructure,operation,applications),process,andpeopleagainstunforeseeablefocusingeventsthatcouldchangetheriskenvironmentLeverageandstreamlineresourcesamongtraditionalbusinesscontinuity,disasterrecovery,emergencyresponse,andITsecurityincidentresponseandmanagementWhyICTReadinessfocusonBusinessContinuity?ICTsystemsareprevalentinorganizationsICTsystemsarenecessarytosupportincident,businesscontinuity,disaster,andemergencyresponseandmanagementneedsBusinesscontinuityisincompletewithoutconsideringICTsystemsreadinessRespondingtosecurityincident,disasters,andemergencysituationsareaboutbusinesscontinuityImplicationsofICTReadinessOperationalStatusTimeIncidentCurrentIHM,BCMandDRPfocusonshorteningperiodofdisruptionandreducingtheimpactofanincidentbyriskmitigationandrecoveryplanning.T=0T=iT=kT=lT=j100%x%y%z%Earlydetectionandresponsecapabilitiestopreventsuddenanddrasticfailure,enablegradualdeteriorationofoperationalstatusandfurthershortenrecoverytime.BeforeimplementationofIHM,BCM,and/orDRPAfterimplementationofIHM,BCM,and/orDRPAfterimplementationofICTReadinessforBCICTReadinessforBusinessContinuityRe-proposedassingle-partstandard(Nov‘07)Structure(DRAFT,DocumentSC27N6274)IntroductionScopeNormativeReferencesTermsandDefinitionsOverview(ofICTReadinessforBusinessContinuity)ApproachBasedonPDCAcyclicalmodelExtendBCPapproach
(usingRA,andBIA)IntroduceFailureScenarioAssessment(withFMEA)FocusonTriggeringEventsManagementofIRBCProgramP2PFileSharingInstantMessagingBloggingWeb2.0CybersecurityIssuesSplogs,SPAM,SearchEnginePoisoningSpywareTrojansVirus/WormsSPAMExploitURLsPhishingTrojansVoIP/VideoPrivacy&InformationBreachGlobalThreatLandscapePrevalenceofMaliciousSoftware––byCategoryWhatisCybersecurityDefinitionofCybersecurityoverlapsInternet/networksecurityNatureCybersecurityissuesOccursontheInternet(Cyberspace)Globalnature,multiplecountries,differentpolicyandregulations,differentfocusMultipleentities,simpleclientsystemtocomplexinfrastructureWeakestlinkandlowestcommondenominatorprevailHighlycreativelandscape––alwayschangingCybersecurityCybersecurityconcernstheprotectionofassetsbelongingtobothorganizationsandusersinthecyberenvironment.Thecyberenvironmentinthiscontextisdefinedasthepublicon-lineenvironment(generallytheInternet)asdistinctfrom““enterprisecyberspace”(closedinternalnetworksspecifictoindividualorganizationsorgroupsoforganizations).GuidelinesforCybersecurity“Bestpractice””guidanceinachievingandmaintainingsecurityinthecyberenvironmentforaudiencesasdefinedbelow.Addresstherequirementforahighlevelofco-operation,information-sharingandjointactionintacklingthetechnicalissuesinvolvedincybersecurity.Thisneedstobeachievedbothbetweenindividualsandorganizationsatanationallevelandinternationally.Theprimaryaudiencesforthestandardare:CyberspaceserviceproviderssuchasInternetServiceProviders(ISPs),webserviceproviders,outsourcinganddataback-upserviceproviders,on-linepaymentbureaux,on-linecommerceoperators,entertainmentserviceprovidersandothers.Enterprisesincludingnotonlycommercialorganizationsbutalsonon-profitbodiesandotherorganizationsinfieldssuchashealthcareandeducation.Governments.Endusers,whilehighlyimportant,arenotseenasakeytargetaudienceastheyarenotingeneraldirectusersofinternationalstandards.Thestandardwillnotoffertechnicalsolutionstoindividualcybersecurityissues,whicharealreadybeingdevelopedbyotherbodiesasdescribedbelow.NetworkSecurityRevisionofISO/IEC18028Re-focus,re-scoping,andnewpartsPart1–Guidelines(Overview,Concepts,Principles)Part2–GuidelinesforDesignandImplementationPart3–ReferenceNetworkingScenarios:Risks,Design,Techniques,andControlIssuesPart4–SecuritycommunicationsbetweennetworksusingsecuritygatewaysPart5–SecuringremoteaccessPart6–SecuritycommunicationsbetweennetworksusingVirtualprivatenetworkPart7–to-be-named““technology””topicSoftwareVulnerabilityDisclosuresOSversusapplicationvulnerabilitiesApplicationvulnerabilitiescontinuedtogrowrelativetooperatingsystemvulnerabilitiesasapercentageofalldisclosuresduring2006SupportstheobservationthatsecurityvulnerabilityresearchersmaybefocusingmoreonapplicationsthaninthepastGuidelinesforApplicationSecurityReducesecurityproblemsattheapplicationlayersEliminatecommonweaknessesatcodeandprocesslevelsStrengthensecurityofcodebaseimproveapplicationsecurityandreliabilityMulti-partsstandards,includingCodeSecurityCertificationProcessSecurityCertificationCodeSecurityTestingandcertificationpermajorreleaseofapplicationProcessSecuritySecurityDevelopmentLifecycleAssuresecurityofcodefromdesigntooperation,includingminorreleases,patchdevelopment&releaseFocusonWeb-basedapplications(majorproblemareas)GuidelinesforApplicationSecuritySpecifyanapplicationsecuritylifecycle,incorporatingthesecurityactivitiesandcontrolsforuseaspartofanapplicationlifecycle,coveringapplicationsdevelopedthroughinternaldevelopment,externalacquisition,outsourcing/offshoring1,orahybridoftheseapproaches.ProvideguidancetobusinessandITmanagers,developers,auditors,andend-userstoensurethatthedesiredlevelofsecurityisattainedinbusinessapplicationsinlinewiththerequirementsoftheorganization’sInformationSecurityManagementSystems(ISMS).Applicationsecurityaddressesallaspectsofsecurityrequiredtodeterminetheinformationsecurityrequirements,andensureadequateprotectionofinformationaccessedbyanapplicationaswellastopreventunauthorizeduseoftheapplicationandunauthorizedactionsofanapplication.Informationalsecurityconcernsinbusinessapplicationsaretobeaddressedinallphasesoftheapplicationlifecycle,asguidedbytheorganization’sriskmanagementprinciplesandtheISMSadopted.GuidelinesforApplicationSecurityStructure(DRAFT)Part1––Overview,definition,concepts,andprinciplesPart2––SecureApplicationLifecyclePart3––SecureApplicationArchitecturePart4––ProtocolsandDataStructure,Input,Processes,andOutputSecurityPart5––ApplicationSecurityAssurancePart6–N-TiersandWebApplicationsSecurity…9、静夜四无无邻,荒居居旧业贫。。。12月-2212月-22Thursday,December29,202210、雨中中黄叶叶树,,灯下下白头头人。。。09:01:3109:01:3109:0112/29/20229:01:31AM11、以我独沈久久,愧君相见见频。。12月-2209:01:3209:01Dec-2229-Dec-2212、故故人人江江:1鸨,,几几度度隔隔山山川川。。。。09:01:3209:01:3209:01Thursday,December29,202213、乍见翻翻疑梦,,相悲各各问年。。。12月-2212月-2209:01:3209:01:32December29,202214、他乡生生白发,,旧国见见青山。。。29十十二月20229:01:32上午午09:01:3212月-2215、比比不不了了得得就就不不比比,,得得不不到到的的就就不不要要。。。。。十二二月月229:01上上午午12月月-2209:01December29,202216、行动出成成果,工作作出财富。。。2022/12/299:01:3209:01:3229December202217、做前,,能够环环视四周周;做时时,你只只能或者者最好沿沿着以脚脚为起点点的射线线向前。。。9:01:32上午午9:01上午午09:01:3212月-229、没有失失败,只只有暂时时停止成成功!。。12月-2212月月-22Thursday,December29,202210、很多事情情努力了未未必有结果果,但是不不努力却什什么改变也也没有。。。09:01:3209:01:3209:0112/29/20229:01:32AM11、成功就是日日复一日那一一点点小小努努力的积累。。。12月-2209:01:3209:01Dec-2229-Dec-2212、世世间间成成事事,,不不求求其其绝绝对对圆圆满满,,留留一一份份不不足足,,可可得得无无限限完完美美。。。。09:01:3209:01:3209:01Thursday,December29,202213、不不知知香香积积寺寺,,数数里里入入云云峰峰。。。。12月月-2212月月-2209:01:3209:01:32December29,202214、意志坚强强的人能把把世界放在在手中像泥泥块一样任任意揉捏。。29十二二月20229:01:32上上午09:01:3212月-2215、楚塞塞三湘湘接,,荆门门九派派通。。。。十二月月229:01上上午午12月月-2209:01December29,202216、少年十五二二十时,步行行夺得胡马骑骑。。2022/12/299:01:3309:01:3329December202217、空山山新雨雨后,,天气气晚来来秋。。。9:01:33上上午9:01上上午午09:01:3312月月-229、杨柳散和风风,青山澹吾吾虑。。12月-2212月-22Thursday,December29,202210、阅读一一切好书书如同和和过去最最杰出的的人谈话话。09:01:3309:01:3309:0112/29/20229:01:33AM11、越越是是没没有有本本领领的的就就越越加加自自命命不不凡凡。。12月月-2209:01:3309:01Dec-2229-Dec-2212、越是是无能能的人人,越越喜欢欢挑剔剔别人人的错错儿。。09:01:3309:01:3309:01Thursday,December29,202213、知知人人者者智智,,自自知知者者明明。。胜胜人人者者有有力力,,自自胜胜者者强强。。12月月-2212月月-2209:01:3309:01:33December29,202214、意志坚坚强的人人能把世世界放在在手中像像泥块一一样任意意揉捏。。29十十二月20229:01:33上午午09:01:3312月-2215、最具挑挑战性的的挑战莫莫过于提提升自我我。。十二月229:01上午午12月-2209:01December29,202216、业业余余生生活活要要有有意意义义,,不不要要越越轨轨。。2022/12/299:01:3309:01:3329December202217、一个人即使使已登上顶峰峰,也仍要自自强不息。9:01:33上午9:01上上午09:01:3312月-22MOMODAPOWERPOINTLoremipsumdolorsitamet,consecteturadipiscingelit.Fusceidurnablandit,eleifendnullaac,fringillapurus.Nullaiaculistemporfelisutcursus.感谢您的下载载观看专家告诉
温馨提示
- 1. 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。图纸软件为CAD,CAXA,PROE,UG,SolidWorks等.压缩文件请下载最新的WinRAR软件解压。
- 2. 本站的文档不包含任何第三方提供的附件图纸等,如果需要附件,请联系上传者。文件的所有权益归上传用户所有。
- 3. 本站RAR压缩包中若带图纸,网页内容里面会有图纸预览,若没有图纸预览就没有图纸。
- 4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
- 5. 人人文库网仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对用户上传分享的文档内容本身不做任何修改或编辑,并不能对任何下载内容负责。
- 6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
- 7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。
kok电子竞技:最新文档
- 借款合同范本中介kok电子竞技
- 云南购房合同范本
- 从化学校食堂承包合同范本
- 保洁公司人员合同范本
- pu线条安装合同范本
- fob合同范本日文
- 包架子合同范本
- 公司代管合同范本
- 共同经营餐厅合同范本
- 三方合作民宿协议合同范本
- 智能财务共享在京东的应用研究
- 卫生和微生物基础知识培训-
- 2023年镇江市高等专科学校单招综合素质题库及答案解析
- XX拦河堰工程施工组织设计
- GB/T 9787-1988热轧等边角钢尺寸、外形、重量及允许偏差
- GB/T 7031-2005机械振动道路路面谱测量数据kok电子竞技
- 马工程教材《公共财政概论》PPT-第十二章 财政体制
- GB/T 23457-2009预铺/湿铺防水卷材
- GB/T 17614.1-2015工业过程控制系统用变送器第1部分:性能评定方法
- 财务工作督导检查记录表
- 舆情大数据监测平台建设方案
评论
0/150
提交评论